diff --git a/roles/web-app-hermes/meta/services.yml b/roles/web-app-hermes/meta/services.yml
index 9364149e84..0886fde2e1 100644
--- a/roles/web-app-hermes/meta/services.yml
+++ b/roles/web-app-hermes/meta/services.yml
@@ -6,6 +6,8 @@ hermes:
       enabled: true
     swarm:
       enabled: true
+  # nocheck: single-replica the agent keeps its kanban state in embedded SQLite on one shared volume, and SQLite takes a single writer lock per file, so concurrent replicas serialise into "database is locked" instead of sharing the work
+  replicas: 1
   bond: 1
   enabled: true
   shared: true
diff --git a/roles/web-app-hermes/meta/volumes.yml b/roles/web-app-hermes/meta/volumes.yml
index b03f6f19d6..29a227a8ad 100644
--- a/roles/web-app-hermes/meta/volumes.yml
+++ b/roles/web-app-hermes/meta/volumes.yml
@@ -1,6 +1,10 @@
 ---
 hermes_data:
   type: volume
+  nfs:
+    uid: "10000"
+    gid: "10000"
+    mode: "0770"
   mounts:
     - service: hermes
       target: /opt/data